GrapheneOS version 2025092500 released

DoctorB0NG

interesting to get access to the security updates with QPR1 missing from AOSP still

Watermelon

DoctorB0NG Vuraze abednego xxx Curious abednego

I suggest you to read my explanation of the topic :) a moderator liked it so together with my belief that it's accurate I presume it's accurate.

https://discuss.grapheneos.org/d/26476-backports-quarterly-releases-security-patches-embargoes/9
https://discuss.grapheneos.org/d/26476-backports-quarterly-releases-security-patches-embargoes/10

Pavestone2734 Personally I would advise against making non-open source security updates opt-in by default, even though I recognise that there is a case to be made about the importance of these updates and the need for the maximum possible amount of users to recieve them. But jnstalling non-foss code by default would come off as a breach of trust to a significant amount of users.

I disagree. The GrapheneOS team has gained my trust through their extremely professional conduct, care for user data and stability, care for security and quick patching… I don't do anything with GrapheneOS's source code, so I don't see what prevents me from getting closed-source patches (written by the GrapheneOS developers) quicker on top of an open source OS from a vendor I trust.

yore

GrapheneOS As I understand it, the security preview releases opt-in is essentially the same as the releases we would be getting in the Stable channel up until now, minus the source code due to the embargo. Is that correct? And if so, how well-tested / suggested would this be?

GrapheneOS

yore It's exactly the same as the regular release it's based on other than a set of future Android Security Bulletin patches still under embargo being applied to the source tree before building. We plan to provide a toggle in the setup wizard for it which will likely be enabled by default. We expect it to be well tested.

yore

nandohyphen1 I asked a similar question in another thread. Here is the project's response:

GrapheneOS It's exactly the same as the regular release it's based on other than a set of future Android Security Bulletin patches still under embargo being applied to the source tree before building. We plan to provide a toggle in the setup wizard for it which will likely be enabled by default. We expect it to be well tested.

Vuraze

No issues to report on P9P using the security preview release.
Also tested SMS and 5G connectivity on T-Mobile with no issues.

alentia

also, it was always the case for at least a year, System will update on roaming, even though it checked not to do so, when you are on VPN. It treats VPN tunnel as WiFi i guess. So when you are roaming on limited bandwith and must have VPN when you are in china for example it may kill your all allowed bandwith/data and add insult to the injury if you are on low battery you by mistake you pressed "reboot" the "application optimization" after the reboot will kill your remaining battery life, i dont think it was ever fixed or reported.

de0u

alentia System will update on roaming, even though it checked not to do so, when you are on VPN. It treats VPN tunnel as WiFi i guess.

I think there have been some reports of this, but I don't think it happens when using a properly-written VPN client. Are you in a position to say which VPN client app is in use?

NetRunner88

de0u

Doesnt happen with wireguard, ivpn client mullvad client nor proton client

alentia

de0u Proton VPN

alentia

NetRunner88 happens on proton, many times already

UseLinux

I know this is probably not the best place to ask this, but does Google even themselves include the listed CVEs from November/December 2025 to their stock Pixel OS every month or are they patching them quarterly as is the case with other OEMs?

What about lower tier, med-/low CVEs on stock Android on a Pixel phone, I presume GrapheneOS is better but by how much?

Thank you for this. I will opt-in for the preview releases also.

GrapheneOS

UseLinux Google isn't shipping the patches early for the stock Pixel OS and we're not aware of any OEM shipping the patches early. A tiny subset of patches are still being put into monthly Android Security Bulletins which are shipped by Pixels and other OEMs. Pixels are also still fixing some Pixel hardware related patches on a monthly basis. Nearly all security patches are now quarterly instead. The quarterly Android Security Bulletins are backports to older releases which come alongside the quarterly and yearly releases including those patches and also the Moderate/Low severity patches. The previews of the backported patches now allow us to ship those early, but it can't be properly open source so we've made a separate security preview release system for it. In the near future, we're going to provide a setup wizard opt-in for the security preview releases which will likely be enabled by default in the setup wizard. Existing users won't be automatically moved to it, but we could make a notification which asks people to choose and is sent once each boot until a choice either way is made.

They've allowed shipping the patches early in binary-only releases which we're now doing via our security preview releases. We can provide the patches we used after the embargo ends. We're doing the preview releases by preparing a set of patches based on the partner preview patches in a Git repository where we're tagging the security preview releases so we can release the additional patches we applied to the source tree with the script needed to apply them once the embargo ends. In some cases we need to resolve conflicts, etc.

What about lower tier, med-/low CVEs on stock Android on a Pixel phone, I presume GrapheneOS is better but by how much?

Android Security Bulletins are backports of patches to the initial yearly releases of Android. Only Critical/High severity patches are backported since quite a while ago, not Moderate/Low severity. There are no Moderate/Low patches in the Android Security Bulletins anymore. The Moderate/Low severity patches are shipped through the new yearly and quarterly releases of Android.

bagel

GrapheneOS are you allowed to publish sources + (security patch) binary blobs? or only "full" builds?
even if not open source, it would be nice to have the ability to build and examine (if possible)

abednego

bagel Do you really build and examine the source code for anything you install on your computers and network appliances?

How do you check that the binaries that are downloaded and installed in your Pixel are built from the unmodified sources you can get from the GrapheneOS repository? Up to my knowledge, GrapheneOS builds are not reproducible, so it is difficult to verify.

Sometimes operating system snapshots (and I am mostly talking about Linux and BSDs here) include experimental code that has not yet been committed. It is usually code that needs to reach a wide audience before being incorporated to a repository because it is highly experimental and may break some things.

In short, there is a line in which we must trust the software developers. Publishing source code is a requirement for a software project to be trusted, as it helps finding bugs (something where an active community and security experts is extremely useful), and assessing the quality of the code, But it does not stop a rogue development team from building and distributing backdoored software by just adding some unpublished source code modifications before compiling.

chinook

GrapheneOS It's possible you have a typo, I believe it's CVE-2025-48539 and not CVE-2025-48593.
You would call actively exploited RCE critical, and the bulletin or other sites mention CVE-2025-48539

GrapheneOS

chinook No, that's incorrect. We shipped the September security patches in https://grapheneos.org/releases#2025090200. You should read the information we provided above and below the list of CVEs fixed in the security preview release. These are November 2025 and December 2025 Android Security Bulletin patches. We're shipping the patches early, not late.

Vuraze

I just checked "Settings > About phone > Android version" and it says it still has the October 2025 security update despite me opting-into and installing the security preview release. Is this intentional?

neotux

Vuraze me opting-into and installing the security preview release

Where, how you can do that?

GrapheneOS

Vuraze abednego abednego The patch level is still supposed to be set to 2025-10-01. There could be 2025-10-05 Pixel patches and the patch level can't be raised above the point at which all patches have been provided. Android Security Bulletins list both AOSP patches in the 01 section and kernel/vendor patches in the 05 section. Devices are also meant to have additional OEM bulletins with more vendor patches not covered in the small subset included in the ASB. If there's a 2025-10-05 Pixel patch, then the overall Pixel patch level is still 2025-10-01 even if the Android patch level could be 2025-10-05 already. We do get previews of what's going to be included in the vendor subset of the ASB but not the Pixel bulletin.

The November 2025 and December 2025 bulletins are also not fully frozen yet. The November patches should be considered frozen in terms of new patches no longer being added after early October. We don't know at exactly which point they're officially frozen with patches not allowed to be added anymore and at which point they can no longer change or remove patches. It may be they can remove patches up to the last day. This is something we need to figure out, although it's not particularly important.

We also don't want to set the security preview patch level higher since then people can't switch back to the next regular OS release since the patch level can't be downgraded. We would need to teach the update client to check patch level and prevent trying to update to a release with a lower one. This would be confusing and if people switched back to regular updates, they would stop getting updates until the patch level caught up to the security preview release. It's best to simply leave the patch level alone. You can see you're on the security preview release from the displayed OS version in the "Build number" field.

Pavestone2734

Personally I would advise against making non-open source security updates opt-in by default, even though I recognise that there is a case to be made about the importance of these updates and the need for the maximum possible amount of users to recieve them. But jnstalling non-foss code by default would come off as a breach of trust to a significant amount of users.

Instead I would recommend notifying users about via notifications, popups, social media posts about this change and putting a toggle into the OS setup screen.

GrapheneOS

Pavestone2734 Security preview updates are remaining disabled by default for existing users, but we can add a notification for people who haven't enabled it asking to choose. For fresh installs, we plan to add it to the setup wizard so people get an explicit choice and the default recommendation can be having security preview updates enabled. For existing users, we can make a notification for people who haven't opted into it where you're given an explicit choice. The notification could be once per boot until an explicit choice is made one way or the other at which point it can be permanently dismissed. New users would have the setup wizard choice so the notification would only be for existing users prior to that being added.

Vuraze

neotux
Settings > System > System updates
Toggle on "Receive security preview releases"

neotux

Vuraze

Thanks! I had totally missed that one.

xxx

Vuraze

Thank you! I missed it also.

abednego

I moved to alpha channel; using OpenBSD-current for two decades without a single problem that will not be quickly fixed by their development team, so why not using GrapheneOS in the same way? Both projects have exceptional development teams.

It works as expected. Installed 2025092500 on my Pixel Tablet, set the use of alternate release channels to receive security patches still under embargo (in my humble opinion, temporary lack of source code is not a problem if GrapheneOS is behind the signed binaries we are retrieving), and quickly arrived a new build, this one numbered 2025092501.

As @Vuraze I see the Android secuirty update remains at October 1, 2025, but I think it is something we should expect.

From what I can see, all is working fine.

Thanks for taking security so seriously! We need more projects like GrapheneOS in a world that has lost its path.

xxx

abednego (in my humble opinion, temporary lack of source code is not a problem if GrapheneOS is behind the signed binaries

abednego Android secuirty update remains at October 1, 2025

Will test on my P6. But I'm unsure if it should stay like this with the extra patches.

abednego

xxx I suppose October 1, 2025 is the last official patchset. May the November and December security updates remain open to new fixes, before being properly called "November 1, 2025" and "December 1, 2025" respectively? Just guessing...

Curious

So what does it mean with that preview?
Can please someone clarify what one get when opt-in for those previews? To what I understand now is that those previews are from 3rd party and closed source or what?

DeletedUser481

Looks like no public information has been released at all about most of these CVE's. So it's kinda hard to know if it's worth changing to a proprietary release for fixes to vulnerabilities I don't even know apply to the way I use the device.

de0u

DeletedUser481 Looks like no public information has been released at all about most of these CVE's. So it's kinda hard to know if it's worth changing to a proprietary release for fixes to vulnerabilities I don't even know apply to the way I use the device.

Unfortunately, that is Google's new security plan. High-risk individuals need a way to get the patches ASAP, so the large amount of extra work that the GrapheneOS team has taken on to make that possible will likely be appreciated.